mirror of
https://gitlab.com/buildroot.org/buildroot.git
synced 2026-08-01 21:23:51 -09:00
e8191c3e17
Fixes the following vulnerabilities by importing upstream patches: - CVE-2026-39979:2f09060afa- CVE-2026-33948:6374ae0bcd- CVE-2026-33947:fb59f14910- CVE-2026-32316:e47e56d226- CVE-2026-40164:0c7d133c3c- CVE-2026-40612:d1a12569d9- CVE-2026-41256:5a015deae3- CVE-2026-41257:01b3cded76- CVE-2026-43894:9761ceb7d6- CVE-2026-43895:9d223f153c- CVE-2026-43896:532ccea608- CVE-2026-44777:f58787c418- CVE-2026-47770:7122866869- CVE-2026-49839:e987df0d46- CVE-2026-54679:46d1da3094Tests were stripped out of the patches. Signed-off-by: Thomas Perale <thomas.perale@mind.be> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
54 lines
2.1 KiB
Diff
54 lines
2.1 KiB
Diff
From e47e56d226519635768e6aab2f38f0ab037c09e5 Mon Sep 17 00:00:00 2001
|
|
From: itchyny <itchyny@cybozu.co.jp>
|
|
Date: Thu, 12 Mar 2026 20:28:43 +0900
|
|
Subject: [PATCH] Fix heap buffer overflow in `jvp_string_append` and
|
|
`jvp_string_copy_replace_bad`
|
|
|
|
In `jvp_string_append`, the allocation size `(currlen + len) * 2` could
|
|
overflow `uint32_t` when `currlen + len` exceeds `INT_MAX`, causing a small
|
|
allocation followed by a large `memcpy`.
|
|
|
|
In `jvp_string_copy_replace_bad`, the output buffer size calculation
|
|
`length * 3 + 1` could overflow `uint32_t`, again resulting in a small
|
|
allocation followed by a large write.
|
|
|
|
Add overflow checks to both functions to return an error for strings
|
|
that would exceed `INT_MAX` in length. Fixes CVE-2026-32316.
|
|
|
|
CVE: CVE-2026-32316
|
|
Upstream: https://github.com/jqlang/jq/commit/e47e56d226519635768e6aab2f38f0ab037c09e5
|
|
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
|
|
---
|
|
src/jv.c | 11 ++++++++++-
|
|
1 file changed, 10 insertions(+), 1 deletion(-)
|
|
|
|
diff --git a/src/jv.c b/src/jv.c
|
|
index 722a539391..2a62b48419 100644
|
|
--- a/src/jv.c
|
|
+++ b/src/jv.c
|
|
@@ -1114,7 +1114,12 @@ static jv jvp_string_copy_replace_bad(const char* data, uint32_t length) {
|
|
const char* end = data + length;
|
|
const char* i = data;
|
|
|
|
- uint32_t maxlength = length * 3 + 1; // worst case: all bad bytes, each becomes a 3-byte U+FFFD
|
|
+ // worst case: all bad bytes, each becomes a 3-byte U+FFFD
|
|
+ uint64_t maxlength = (uint64_t)length * 3 + 1;
|
|
+ if (maxlength >= INT_MAX) {
|
|
+ return jv_invalid_with_msg(jv_string("String too long"));
|
|
+ }
|
|
+
|
|
jvp_string* s = jvp_string_alloc(maxlength);
|
|
char* out = s->data;
|
|
int c = 0;
|
|
@@ -1174,6 +1179,10 @@ static uint32_t jvp_string_remaining_space(jvp_string* s) {
|
|
static jv jvp_string_append(jv string, const char* data, uint32_t len) {
|
|
jvp_string* s = jvp_string_ptr(string);
|
|
uint32_t currlen = jvp_string_length(s);
|
|
+ if ((uint64_t)currlen + len >= INT_MAX) {
|
|
+ jv_free(string);
|
|
+ return jv_invalid_with_msg(jv_string("String too long"));
|
|
+ }
|
|
|
|
if (jvp_refcnt_unshared(string.u.ptr) &&
|
|
jvp_string_remaining_space(s) >= len) {
|